Cookies

These are required for the Service to work; they are not subject to consent.

• Session cookie (img_session) — keeps you logged in.
• CSRF token (img_csrf) — protects forms from cross-site request forgery.
• Consent record — set by the cookie banner (where shown) to remember your choice.

We use PostHog Cloud EU for browser product analytics on eligible requests. Its environment-specific first-party persistence key is named ph_img_products_production or ph_img_products_test and may be stored as a cookie and in local storage for up to 365 days; our loader enforces that maximum for the local-storage copy as well as configuring the cookie lifetime. A separate __ph_img_products_<environment>_consent key stores the PostHog opt-in/out state. These maintain an anonymous or signed-in visitor identifier, session and device continuity, and analytics feature state without mixing test and production journeys.

For non-strict geolocations, browser analytics is available by default until you opt out. Strict or unknown geolocations require an explicit opt-in. Global Privacy Control disables tracking everywhere. Signed-in activity uses only opaque img.pro user and app/workspace identifiers; we do not send names or email addresses. URLs are reduced to query-free route templates; validated UTM source, medium, and campaign dimensions may be retained separately while search terms and ad-click identifiers are dropped. Inputs and visible text are masked, user media and private content are blocked, and console output and network bodies are not recorded.

Choosing Reject marketing or Opt out immediately tells PostHog to stop browser capture, resets its browser identity, removes its first-party cookie and local-storage state in this browser, and disables future anonymous browser-to-server journey linkage. It does not suppress the bounded pseudonymous server outcomes or Stripe billing-source records listed in the Privacy Policy, undo a transaction or revenue join already received, erase historical records, or clear storage on another device. Email privacy@img.pro for access, objection, or deletion requests.

The Reddit browser pixel and click-identifier capture load after explicit consent where prior consent is required (EU/EEA, United Kingdom, Switzerland, Brazil). Elsewhere they are available by default until you opt out. Reddit's server-side conversion processing is separate from this browser-cookie preference and is described in the Privacy Policy.

We honor the Global Privacy Control signal as an opt-out request for "sale" and "share" of personal information, in line with CPRA.

You can update your choice at any time using the buttons below. The change takes effect on your next page load.

You can also block or clear cookies in your browser's settings, though doing so for the strictly-necessary cookies above will break parts of the Service (you will be logged out, and forms will fail CSRF checks).